Cookie policy reflects current cookies; updated when cookies change
Why it matters
GDPR Art. 13 requires that disclosures be accurate and current — a cookie policy listing Hotjar when the application no longer loads Hotjar, or omitting Segment which was added last quarter, means users are making consent decisions based on incorrect information. GDPR Art. 5(1)(a)'s accuracy principle applies to policy disclosures as much as to personal data records. A policy with placeholder text or a stale 'Last updated: 2022' date is a signal regulators treat as evidence that the compliance process is not operational, which can convert an isolated technical finding into a systemic accountability failure under Art. 5(2).
Severity rationale
Info because a stale policy is a documentation and accountability failure rather than an active collection violation, but it demonstrates to regulators that the consent compliance process is not maintained — compounding the severity of any co-existing collection failures.
Remediation
Track a COOKIE_POLICY_UPDATED constant alongside COOKIE_REGISTRY and render it on the policy page. Add updating it to the checklist for any new third-party integration.
// src/lib/cookies/registry.ts
export const COOKIE_POLICY_UPDATED = '2026-04-18' // ISO 8601 — bump with registry changes
// app/cookies/page.tsx
import { COOKIE_POLICY_UPDATED } from '@/lib/cookies/registry'
<p className="text-sm text-gray-500">
Last updated:{' '}
{new Date(COOKIE_POLICY_UPDATED).toLocaleDateString('en-GB', {
day: 'numeric', month: 'long', year: 'numeric',
})}
</p>
If COOKIE_REGISTRY drives the policy page, the content stays current automatically. The only manual step is bumping COOKIE_POLICY_UPDATED when the registry changes and committing both in the same PR.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — GDPR — information provided at collection must remain accurate and current
- gdpr · Art. 5(1)(a) — GDPR — transparency principle requires up-to-date disclosure
- eprivacy · Art. 5(3) — ePrivacy Directive — consent is only valid for the purposes stated at time of collection; stale policy invalidates consent
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated